Integer-overflow in AllPassFilter |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6376009465856000 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: AllPassFilter SplitFilter WebRtcVad_CalculateFeatures Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=572608:573019 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6376009465856000 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jul 9
WebRTC revision range: https://webrtc.googlesource.com/src/+log/57900cb93360989624d0b165baab2f08ebebb92e..d39ce8d45bc9bcfaef2b3d39bb24d04fa962cfe8?pretty=fuller&n=10000 Can't find a clear CL in the list above which is related to AllPass. Asking for assistance.
,
Jul 9
@aleloi: the issues might be related to the ongoing work on AGC, could you check if any of the CLs in the revision range?
,
Jul 20
This is a known issue. The comment just above the line that overflows is // The filter can only cause overflow (in the w16 output variable) // if more than 4 consecutive input numbers are of maximum value and // has the the same sign as the impulse responses first taps. // First 6 taps of the impulse response: // 0.6399 0.5905 -0.3779 0.2418 -0.1547 0.0990 Original devs knew about this and thought it unimportant. Bumping down to P3.
,
Oct 2
ClusterFuzz has detected this issue as fixed in range 595400:595401. Detailed report: https://clusterfuzz.com/testcase?key=6376009465856000 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: AllPassFilter SplitFilter WebRtcVad_CalculateFeatures Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=572608:573019 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=595400:595401 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6376009465856000 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 2
ClusterFuzz testcase 6376009465856000 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Jul 9Labels: ClusterFuzz-Auto-CC